ABOUT THE OFFICE
Defense Privacy Board Advisory Opinions
ACCOUNTING FOR MASS DISCLOSURES OF RECORDS TO OTHER AGENCIES
It is inappropriate to enter into inter–agency support agreements negating the requirement to keep an accounting of disclosures made from systems of records. Except for disclosures made within the agency or pursuant to the Freedom of Information Act, each agency must keep an accurate accounting of all disclosures made from systems of records under its control. 5 U.S.C.§ 552a(c).
Neither the Privacy Act nor the Office of Management and Budget Privacy Act Guidelines, however, specify a form for maintaining the accounting. See 40 Fed. Reg. 28949, 28956 (July 9, 1975). They require only that an accounting be maintained, that it be available to the individual to whom the record pertains, that it be used to advise previous recipients of corrections to records, and that it be maintained so a disclosure of records may be traced to the records disclosed. Individual records need not be marked to reflect disclosure unless necessary to satisfy this tracing requirement.
With respect to mass disclosures, if disclosures are of all records or all of a category of records, it is sufficient simply to identify the category of records disclosed, including the other information required under 5 U.S.C. § 552a(c), in a comprehensible form and make it available as required. Similarly, if disclosures occur at fixed intervals, a statement to that effect, as opposed to a statement at each occasion of disclosure, will satisfy the accounting requirement. If a mass disclosure is not of a complete category of records but, for example, of a random selection within a category, then the above information with a list of individuals whose records were disclosed could be maintained. Appropriate officials then could review this list to provide information to satisfy accounting provisions of the Act.